Got an interesting little issue. On one of our servers in particular, IIS 7.5 is not hiding the App_Data folder; it's serving it directly. Other servers don't have this problem, even if they're set up relatively similarly.
That folder obviously needs to be hidden. In fact, it's supposed to be fairly tricky to unhide it, if not basically disallowed altogether.
I ran a search for App_Data
in Notepad++, to see if some web.config file or something had it mentioned (even though this should never be the case), and sure enough, there was no mention of it anywhere in the overall website's directory (except in extremely basic code that is not causing this). The app pool is DefaultAppPool
, which should have relatively limited priveleges, and the Windows user permissions on the folder itself are set up the same way as they are with the other servers. As far as Googling this goes, any results are basically getting drowned out by people who are trying to make the directory visible, often while dealing with .NET code.
Where do you start in tracking down this issue?